Struct TenantPath 

pub struct TenantPath {
    pub segments: Vec<u64>,
}

Represents a hierarchical tenant path.

Tenants can be organized in a hierarchy using opaque numeric IDs. The path is represented as a vector of numeric tenant ID segments. Uses / separator to align with AWS ARN conventions.

Fields

segments: Vec<u64>

Ordered segments of the tenant hierarchy (e.g., [12345678, 87654321, 99999999])

Implementations

impl TenantPath

pub fn new(segments: Vec<u64>) -> TenantPath

Creates a new tenant path from numeric segments.

pub fn single(tenant_id: u64) -> TenantPath

Creates a tenant path from a single numeric tenant ID.

Examples found in repository

examples/18_session_tokens.rs (line 30)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== Session Tokens ===\n");

    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));

    // Create context
    let context = WamiContext::builder()
        .instance_id("123456789012")
        .tenant_path(TenantPath::single(0))
        .caller_arn(
            WamiArn::builder()
                .service(wami::arn::Service::Iam)
                .tenant_path(TenantPath::single(0))
                .wami_instance("123456789012")
                .resource("user", "admin")
                .build()?,
        )
        .is_root(false)
        .build()?;

    // Create user
    let user_service = UserService::new(store.clone());
    let alice_req = CreateUserRequest {
        user_name: "alice".to_string(),
        path: Some("/".to_string()),
        permissions_boundary: None,
        tags: None,
    };
    let alice = user_service.create_user(&context, alice_req).await?;
    println!("Step 1: Created user alice");
    println!("  ARN: {}\n", alice.arn);

    // Generate session token
    let sts_service = SessionTokenService::new(store.clone());

    let token_req = GetSessionTokenRequest {
        duration_seconds: Some(3600),
        serial_number: None,
        token_code: None,
    };

    let response = sts_service
        .get_session_token(&context, token_req, &alice.arn)
        .await?;

    println!("Step 2: Generated session token");
    println!("  Access Key: {}", response.credentials.access_key_id);
    println!(
        "  Secret Key: {}...",
        &response.credentials.secret_access_key[..20]
    );
    println!(
        "  Session Token: {}...",
        &response.credentials.session_token[..30]
    );
    println!("  Expiration: {}", response.credentials.expiration);

    println!("\n✅ Example completed successfully!");
    println!("Key takeaways:");
    println!("- Session tokens provide temporary credentials");
    println!("- Credentials expire after specified duration");
    println!("- Useful for temporary or delegated access");

    Ok(())
}

examples/20_federated_access.rs (line 30)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== Federated Access ===\n");

    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));

    // Create context
    let context = WamiContext::builder()
        .instance_id("123456789012")
        .tenant_path(TenantPath::single(0))
        .caller_arn(
            WamiArn::builder()
                .service(wami::arn::Service::Iam)
                .tenant_path(TenantPath::single(0))
                .wami_instance("123456789012")
                .resource("user", "admin")
                .build()?,
        )
        .is_root(false)
        .build()?;

    // Create admin user who will generate federation tokens
    let user_service = UserService::new(store.clone());
    let admin = user_service
        .create_user(
            &context,
            CreateUserRequest {
                user_name: "admin".to_string(),
                path: Some("/".to_string()),
                permissions_boundary: None,
                tags: None,
            },
        )
        .await?;

    let fed_service = FederationService::new(store.clone());

    println!("Step 1: Generating federation token for external user...\n");

    let fed_req = GetFederationTokenRequest {
        name: "partner-user".to_string(),
        duration_seconds: Some(3600),
        policy: Some(r#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*"}]}"#.to_string()),
    };

    let response = fed_service
        .get_federation_token(&context, fed_req, &admin.arn)
        .await?;

    println!("✓ Generated federation token:");
    println!("  Federated User ARN: {}", response.federated_user.arn);
    println!("  Access Key: {}", response.credentials.access_key_id);
    println!("  Expiration: {}", response.credentials.expiration);

    println!("\n✅ Example completed successfully!");
    println!("Key takeaways:");
    println!("- Federation enables external user access");
    println!("- Temporary credentials with limited permissions");
    println!("- Useful for partner integrations");

    Ok(())
}

examples/01_hello_wami.rs (line 31)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== Hello WAMI ===\n");

    // Step 1: Initialize the store
    println!("Step 1: Initializing in-memory store...");
    let mut store = InMemoryWamiStore::default();
    println!("✓ Store initialized");

    // Step 2: Create a WamiContext for operations
    println!("\nStep 2: Creating WAMI context...");
    let context = WamiContext::builder()
        .instance_id("123456789012")
        .tenant_path(TenantPath::single(0)) // Root tenant ID is 0
        .caller_arn(
            WamiArn::builder()
                .service(wami::arn::Service::Iam)
                .tenant_path(TenantPath::single(0))
                .wami_instance("123456789012")
                .resource("user", "admin")
                .build()?,
        )
        .is_root(false)
        .build()?;
    println!("✓ Context created");

    // Step 3: Build a user using pure functions
    println!("\nStep 3: Building user 'alice'...");
    let user = build_user("alice".to_string(), Some("/".to_string()), &context)?;
    println!("✓ User built with ARN: {}", user.wami_arn);

    // Step 4: Store the user
    println!("\nStep 4: Storing user in the store...");
    let created_user = store.create_user(user).await?;
    println!("✓ User stored successfully");
    println!("  - Name: {}", created_user.user_name);
    println!("  - User ID: {}", created_user.user_id);
    println!("  - ARN: {}", created_user.wami_arn);

    // Step 5: Retrieve the user
    println!("\nStep 5: Retrieving user from store...");
    let retrieved = store.get_user("alice").await?;
    match retrieved {
        Some(user) => {
            println!("✓ User retrieved successfully");
            println!("  - Name: {}", user.user_name);
            println!("  - Path: {}", user.path);
        }
        None => println!("✗ User not found"),
    }

    println!("\n✅ Example completed successfully!");
    println!("Key takeaways:");
    println!("- InMemoryWamiStore provides a simple storage backend");
    println!("- Providers (AWS, GCP, Azure) handle platform-specific details");
    println!("- Pure functions create domain objects without side effects");

    Ok(())
}

examples/15_policy_evaluation_simulation.rs (line 30)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== Policy Evaluation Simulation ===\n");

    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));

    // Create context
    let context = WamiContext::builder()
        .instance_id("123456789012")
        .tenant_path(TenantPath::single(0))
        .caller_arn(
            WamiArn::builder()
                .service(wami::arn::Service::Iam)
                .tenant_path(TenantPath::single(0))
                .wami_instance("123456789012")
                .resource("user", "admin")
                .build()?,
        )
        .is_root(false)
        .build()?;

    let eval_service = EvaluationService::new(store.clone(), "123456789012".to_string());
    let user_service = UserService::new(store.clone());

    // Create user
    println!("Step 1: Creating user...\n");
    let req = CreateUserRequest {
        user_name: "alice".to_string(),
        path: Some("/".to_string()),
        permissions_boundary: None,
        tags: None,
    };
    let alice = user_service.create_user(&context, req).await?;
    println!("✓ Created alice: {}", alice.arn);

    // === SIMULATE POLICY ===
    println!("\n\nStep 2: Simulating custom policy...\n");

    let policy_doc = r#"{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject", "s3:PutObject"],
    "Resource": "arn:aws:s3:::my-bucket/*"
  }]
}"#;

    // Test allowed action
    let sim_req = SimulateCustomPolicyRequest {
        policy_input_list: vec![policy_doc.to_string()],
        action_names: vec!["s3:GetObject".to_string()],
        resource_arns: Some(vec!["arn:aws:s3:::my-bucket/file.txt".to_string()]),
        context_entries: None,
    };

    let result = eval_service.simulate_custom_policy(sim_req).await?;
    println!("✓ Simulation: s3:GetObject on my-bucket/file.txt");
    println!("  Decision: {}", result.evaluation_results[0].eval_decision);

    // Test denied action
    let denied_req = SimulateCustomPolicyRequest {
        policy_input_list: vec![policy_doc.to_string()],
        action_names: vec!["s3:DeleteObject".to_string()],
        resource_arns: Some(vec!["arn:aws:s3:::my-bucket/file.txt".to_string()]),
        context_entries: None,
    };

    let denied_result = eval_service.simulate_custom_policy(denied_req).await?;
    println!("\n✓ Simulation: s3:DeleteObject on my-bucket/file.txt");
    println!(
        "  Decision: {}",
        denied_result.evaluation_results[0].eval_decision
    );

    println!("\n✅ Example completed successfully!");
    println!("Key takeaways:");
    println!("- Policy simulation helps test before deployment");
    println!("- Simulate custom policies or principal policies");
    println!("- Understand allow/deny decisions");
    println!("- Identify missing permissions");

    Ok(())
}

examples/19_role_assumption_workflow.rs (line 31)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== Role Assumption Workflow ===\n");

    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));

    // Create context
    let context = WamiContext::builder()
        .instance_id("123456789012")
        .tenant_path(TenantPath::single(0))
        .caller_arn(
            WamiArn::builder()
                .service(wami::arn::Service::Iam)
                .tenant_path(TenantPath::single(0))
                .wami_instance("123456789012")
                .resource("user", "admin")
                .build()?,
        )
        .is_root(false)
        .build()?;

    let user_service = UserService::new(store.clone());
    let role_service = RoleService::new(store.clone());
    let sts_service = AssumeRoleService::new(store.clone());

    // Create user
    println!("Step 1: Creating user...\n");
    let alice = user_service
        .create_user(
            &context,
            CreateUserRequest {
                user_name: "alice".to_string(),
                path: Some("/".to_string()),
                permissions_boundary: None,
                tags: None,
            },
        )
        .await?;
    println!("✓ Created alice: {}", alice.arn);

    // Create elevated role
    println!("\nStep 2: Creating admin role...\n");
    let trust_policy = r#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"*"},"Action":"sts:AssumeRole"}]}"#;
    let role = role_service
        .create_role(
            &context,
            CreateRoleRequest {
                role_name: "AdminRole".to_string(),
                path: Some("/".to_string()),
                assume_role_policy_document: trust_policy.to_string(),
                description: Some("Admin role for elevated access".to_string()),
                max_session_duration: Some(3600),
                permissions_boundary: None,
                tags: None,
            },
        )
        .await?;
    println!("✓ Created AdminRole: {}", role.arn);

    // Assume role
    println!("\nStep 3: Alice assuming AdminRole...\n");
    let assume_req = AssumeRoleRequest {
        role_arn: role.arn.clone(),
        role_session_name: "alice-admin-session".to_string(),
        duration_seconds: Some(3600),
        external_id: None,
        policy: None,
    };

    let response = sts_service
        .assume_role(&context, assume_req, &alice.arn)
        .await?;
    println!("✓ Successfully assumed role!");
    println!("  Assumed Role ARN: {}", response.assumed_role_user.arn);
    println!("  Access Key: {}", response.credentials.access_key_id);
    println!("  Expiration: {}", response.credentials.expiration);

    println!("\n✅ Example completed successfully!");
    println!("Key takeaways:");
    println!("- AssumeRole provides temporary elevated permissions");
    println!("- Trust policies control who can assume roles");
    println!("- Session credentials expire automatically");

    Ok(())
}

examples/09_multi_cloud_user_sync.rs (line 29)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("=== Multi-Cloud User Sync ===\n");

    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));

    // Create context for operations
    let context = WamiContext::builder()
        .instance_id("123456789012")
        .tenant_path(TenantPath::single(0))
        .caller_arn(
            WamiArn::builder()
                .service(wami::arn::Service::Iam)
                .tenant_path(TenantPath::single(0))
                .wami_instance("123456789012")
                .resource("user", "admin")
                .build()?,
        )
        .is_root(false)
        .build()?;

    println!("✓ Using unified context for all operations");

    // === CREATE USER ===
    println!("\n\nStep 1: Creating alice user...\n");

    let user_service = UserService::new(store.clone());

    let user_req = CreateUserRequest {
        user_name: "alice".to_string(),
        path: Some("/cloud-sync/".to_string()),
        permissions_boundary: None,
        tags: Some(vec![
            wami::types::Tag {
                key: "Email".to_string(),
                value: "alice@company.com".to_string(),
            },
            wami::types::Tag {
                key: "MultiCloud".to_string(),
                value: "true".to_string(),
            },
        ]),
    };

    let user = user_service.create_user(&context, user_req).await?;
    println!("✓ Created alice:");
    println!("  - ARN: {}", user.arn);
    println!("  - User ID: {}", user.user_id);
    println!("  - WAMI ARN: {}", user.wami_arn);

    // === COMPARE ARN FORMATS ===
    println!("\n\nStep 2: Understanding WAMI ARN format...\n");

    println!("WAMI unified ARN:");
    println!("  {}", user.wami_arn);
    println!("\nThis ARN can be transformed to provider-specific formats:");
    println!("  - AWS ARN format for AWS API calls");
    println!("  - GCP resource name format for GCP API calls");
    println!("  - Azure resource ID format for Azure API calls");

    // === DEMONSTRATE PROVIDER METADATA ===
    println!("\n\nStep 3: Understanding WAMI architecture...\n");

    println!("WAMI provides:");
    println!("- Unified WAMI ARN format (for internal operations)");
    println!("- Provider-specific ARN transformation when needed");
    println!("- Consistent resource identification across clouds");
    println!("- Tags for categorization and metadata");

    println!("\nBenefits:");
    println!("- Unified identity management across clouds");
    println!("- Provider-agnostic operations with context");
    println!("- Cross-cloud audit trails with WAMI ARNs");
    println!("- Multi-cloud resource tracking");

    println!("\n✅ Example completed successfully!");
    println!("Key takeaways:");
    println!("- WAMI uses a unified ARN format internally");
    println!("- Provider-specific ARNs can be generated when needed");
    println!("- Context-based operations work across all providers");
    println!("- Use tags to track cross-cloud relationships");

    Ok(())
}

Additional examples can be found in:

• examples/10_provider_switching.rs
• examples/17_attribute_based_access_control.rs
• examples/02_basic_crud_operations.rs
• examples/03_service_layer_intro.rs
• examples/05_tenant_hierarchy.rs
• examples/24_policy_attachment.rs
• examples/06_tenant_quotas_and_limits.rs
• examples/14_policy_basics.rs
• examples/11_hybrid_cloud_setup.rs
• examples/07_cross_tenant_role_assumption.rs
• examples/16_role_based_access_control.rs
• examples/12_provider_specific_features.rs
• examples/04_simple_multi_tenant.rs
• examples/08_tenant_migration.rs
• examples/13_disaster_recovery_multi_cloud.rs
• examples/23_permissions_boundaries.rs
• examples/22_identity_providers_federation.rs

pub fn from_segments<I>(segments: I) -> TenantPath

where I: Into<Vec<u64>>,

Creates a tenant path from an iterator of numeric segments.

pub fn as_string(&self) -> String

Returns the full path as a string joined by ‘/’.

pub fn root(&self) -> Option<String>

Returns the root (first) tenant ID as a string.

pub fn leaf(&self) -> Option<String>

Returns the leaf (last) tenant ID as a string.

pub fn root_u64(&self) -> Option<u64>

Returns the root (first) tenant ID as u64.

pub fn leaf_u64(&self) -> Option<u64>

Returns the leaf (last) tenant ID as u64.

pub fn depth(&self) -> usize

Returns the depth of the tenant hierarchy.

pub fn starts_with(&self, other: &TenantPath) -> bool

Check if this tenant path starts with another tenant path (is a child or same)

pub fn is_descendant_of(&self, other: &TenantPath) -> bool

Returns true if this path is a descendant of the given path.

pub fn is_ancestor_of(&self, other: &TenantPath) -> bool

Returns true if this path is an ancestor of the given path.

Trait Implementations

impl Clone for TenantPath

fn clone(&self) -> TenantPath

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TenantPath

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for TenantPath

fn deserialize<D>( deserializer: D, ) -> Result<TenantPath, <D as Deserializer<'de>>::Error>

where D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for TenantPath

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Eq for TenantPath

impl Hash for TenantPath

fn hash<__H>(&self, state: &mut __H)

where __H: Hasher,

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for TenantPath

fn eq(&self, other: &TenantPath) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for TenantPath

fn serialize<S>( &self, serializer: S, ) -> Result<<S as Serializer>::Ok, <S as Serializer>::Error>

where S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for TenantPath